db49640072320f33cbbcc3543ae71898214ff0decd8f2c004e308bf0e79d856c

Analysis

Target
DB49640072320F33CBBCC3543AE71898214FF0DECD8F2C004E308BF0E79D856C.exe
Size 9.3MB
Sample220626-mpdmgacfb2
SHA256 db49640072320f33cbbcc3543ae71898214ff0decd8f2c004e308bf0e79d856c
MD5 597a8f5aa2268c9cfed5fa8901900ff6
SHA1 8a50ab2d0a60e5f0ec3ac0a9ed74a29dcbb70f00
SHA512 68a92367c56a7b8d82edb6ebe62adbd58a7126f76cf8db23bc2e113ba223923cce370279d54df422a6c3e1e5d0215005bde47f72fdeb6a1e24abd2f8cd44a10b
MD5 SHA1 SHA512

Score

1^/10

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DB49640072320F33CBBCC3543AE71898214FF0DECD8F2C004E308BF0E79D856C.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	DB49640072320F33CBBCC3543AE71898214FF0DECD8F2C004E308BF0E79D856C.exe

C:\Users\Admin\AppData\Local\Temp\DB49640072320F33CBBCC3543AE71898214FF0DECD8F2C004E308BF0E79D856C.exe
"C:\Users\Admin\AppData\Local\Temp\DB49640072320F33CBBCC3543AE71898214FF0DECD8F2C004E308BF0E79D856C.exe"
1⤵
- Checks processor information in registry
PID:3192

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact